Applying attestation tokens to multicast routing protocols

1. A first network apparatus, comprising:

one or more processors; and

one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause the first network apparatus to perform operations comprising:

receiving, from a second network apparatus, a first multicast message comprising:

attestation-capability information associated with the second network apparatus, wherein the attestation-capability information is any information that indicates whether a particular network node is capable of supporting attestation procedures in a multicast routing protocol; and

an attestation token, wherein the attestation token is for proving that the second network apparatus is in a known safe state;

determining that the attestation-capability information satisfies a pre-determined attestation capability requirement;

forwarding the attestation token and an identity of the second network apparatus to a third-party verifier;

receiving a response comprising a confirmation that the attestation token is valid for the second network apparatus at a current time;

determining that the attestation token is valid for the second network apparatus at the current time; and

establishing an adjacency to the second network apparatus.

2. The first network apparatus of claim 1 , wherein the first multicast message is one of the following:

a Protocol-Independent Multicast (PIM) hello message; or

a Label Distribution Protocol (LDP) message.

3. The first network apparatus of claim 1 , the operations further comprising:

receiving, from a third network apparatus, a second multicast message comprising attestation-capability information associated with the third network apparatus;

determining that the attestation-capability information fails to satisfy the pre-determined attestation capability requirement; and

dropping a multicast message originated from the third network apparatus.

4. The first network apparatus of claim 1 , the operations further comprising determining that a security level associated with the second network apparatus satisfies a pre-determined security level threshold, wherein the first multicast message comprises the security level.

5. The first network apparatus of claim 1 ,

wherein the third-party verifier is determined to be trustworthy.

6. The first network apparatus of claim 1 , the operations further comprising:

receiving, from a third network apparatus, a second multicast message comprising a second attestation token, wherein the second attestation token is for proving that the third network apparatus is in a known safe state;

determining that the second attestation token is invalid for the third network apparatus at a current time; and

processing the second multicast message based on a local policy.

7. The first network apparatus of claim 6 , wherein the local policy instructs the first network apparatus to drop the second multicast message if the second attestation token is invalid for the third network apparatus at the current time.

8. A method, comprising:

receiving, by a first network apparatus, a first multicast message from a second network apparatus, the first multicast message comprising:

attestation-capability information associated with the second network apparatus, wherein the attestation-capability information is any information that indicates whether a particular network node is capable of supporting attestation procedures in a multicast routing protocol; and

an attestation token, wherein the attestation token is for proving that the second network apparatus is in a known safe state;

determining, by the first network apparatus, that the attestation-capability information satisfies a pre-determined attestation capability requirement;

forwarding the attestation token and an identity of the second network apparatus to a third-party verifier;

receiving a response comprising a confirmation that the attestation token is valid for the second network apparatus at a current time;

determining, by the first network apparatus, that the attestation token is valid for the second network apparatus at the current time; and

establishing, by the first network apparatus, an adjacency to the second network apparatus.

9. The method of claim 8 , wherein the first multicast message is one of the following:

a Protocol-Independent Multicast (PIM) hello message; or

a Label Distribution Protocol (LDP) message.

10. The method of claim 8 , further comprising:

receiving, from a third network apparatus, a second multicast message comprising attestation-capability information associated with the third network apparatus;

determining that the attestation-capability information fails to satisfy the pre-determined attestation capability requirement; and

dropping any multicast message originated from the third network apparatus.

11. The method of claim 8 , further comprising determining that a security level associated with the second network apparatus satisfies a pre-determined security level threshold, wherein the first multicast message comprises the security level.

12. The method of claim 8 ,

wherein the third-party verifier is determined to be trustworthy.

13. The method of claim 8 , further comprising:

receiving, from the first network apparatus, a second multicast message from a third network apparatus, the second multicast message comprising a second attestation token, wherein the second attestation token is for proving that the third network apparatus is in a known safe state;

determining, by the first network apparatus, that the second attestation token is invalid for the third network apparatus at a current time; and

processing, by the first network apparatus, the second multicast message based on a local policy.

14. The method of claim 13 , wherein the local policy instructs the first network apparatus to drop the second multicast message if the second attestation token is invalid for the third network apparatus at the current time.

15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, by a first network apparatus, a first multicast message from a second network apparatus, the first multicast message comprising:

attestation-capability information associated with the second network apparatus, wherein the attestation-capability information is any information that indicates whether a particular network node is capable of supporting attestation procedures in a multicast routing protocol; and

an attestation token, wherein the attestation token is for proving that the second network apparatus is in a known safe state;

determining, by the first network apparatus, that the attestation-capability information satisfies a pre-determined attestation capability requirement;

forwarding the attestation token and an identity of the second network apparatus to a third-party verifier;

receiving a response comprising a confirmation that the attestation token is valid for the second network apparatus at a current time;

determining, by the first network apparatus, that the attestation token is valid for the second network apparatus at the current time; and

establishing, by the first network apparatus, an adjacency to the second network apparatus.

16. The one or more computer-readable non-transitory storage media of claim 15 , wherein the first multicast message is one of the following:

a Protocol-Independent Multicast (PIM) hello message; or

a Label Distribution Protocol (LDP) message.

17. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

receiving, from a third network apparatus, a second multicast message comprising attestation-capability information associated with the third network apparatus;

determining that the attestation-capability information fails to satisfy the pre-determined attestation capability requirement; and

dropping any multicast message originated from the third network apparatus.

18. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising determining that a security level associated with the second network apparatus satisfies a pre-determined security level threshold, wherein the first multicast message comprises the security level.

19. The one or more computer-readable non-transitory storage media of claim 15 ,

wherein the third-party verifier is determined to be trustworthy.

20. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

receiving, from the first network apparatus, a second multicast message from a third network apparatus, the second multicast message comprising a second attestation token, wherein the second attestation token is for proving that the third network apparatus is in a known safe state;

determining, by the first network apparatus, that the second attestation token is invalid for the third network apparatus at a current time; and

processing, by the first network apparatus, the second multicast message based on a local policy.